Viruses / Trojans

Here's the story...

For the past few weeks my computer has seriously been crawling. Last night I started to get alerts from my antivirus software (Norton) that it blocked a threat, a trojan. So, I started to do the scans as recommended. I've attached my log files.

BEFORE YOU LOOK AT MY FILES.... I had a couple of issues during the scans. During the Combofix scan a box popped up saying that it detected rootkit activity and that it would take steps to fix it.

Then when I tried doing the Rootrepeal scan I realized I didn't have a program on my computer to unzip files so I used the "search online to find a program" option that Microsoft offered. I ended up downloading Bitzipper which unfortunately comes with a lot of extras (savings coupons, toolbars, games, etc.). As soon as I was finished unzipping the rootrepeal I uninstalled everything that came with Bitzipper. Once that was done another box popped up - PC Optimizer Pro! It tried scanning my computer so I rebooted. When my computer rebooted I right clicked on my toolbar to go to my task manager and I killed the PC Optimizer Pro so it wouldn't start up again. I then uninstalled that program. As far as I can tell it's gone, but of course I know it's probably just laying dormant right now. I had done all the steps before the PC Optimizer Pro issue except for the MG Tools which I just did. Based on all that, should I rerun all of the programs again? Should I still turn off my antivirus?

Oh, and to make things worst I wasn't able to get rootrepeal to run after going through all of that. I'm telling you I'm about ready to pull my hair out!!

Anyway, here are my logs...

 

Please tell me this won't cause a problem! My brother didn't know I was doing all these scans and he shut my computer down this morning. He thought I forgot to shut it down and that he was doing me a favor. I haven't turned it on yet, I'm sending this message from work. I really hope he didn't screw this all up.

 

Done and here are the logs. Thanks for helping!

 

OK. I did what you said and had a couple of issues during the Combofix scan.

First, when it was starting up a box poped up saying something about an iexplorer.exe error. Unfortunately the box disappeared before I could take a pic of it so I don't know exactly what it was.

A little while later the box popped up saying rootkit activity was detected and that it needed to restart.

Then on stage 5 another error popped up saying the following:

The instruction at "0x0039c4af" referenced memory at "0x08004b0d". The memory could not be "written".

Click on OK to terminate the program
Click on CANCEL to debug the program

I didn't know which one to do so I clicked on Cancel.

Attached is the report generated.

 

Here you go.

Now my antivirus is popping up saying Backdoor.Graybird was detected/blocked.

Man I hate this!!

 

I don't know how to get the file name/path. I'm definitely not a computer expert or I wouldn't be here, but I THINK that the backdoor.graybird issue may have been because I was trying to download the OTL program. It popped up just as I was trying to download it, but once disabled my antivirus, downloaded OTL, ran the scan, and the enabled my antivirus it said nothing about backdoor.graybird again. It hasn't said anything since. I'm running Norton, do you think that it could've conflicted with OTL and thought it was the virus?

 

Hello Mandy,

I will help you while my good colleague Kestrel takes a break.

Please follow the below instructions:

Please download Disable/Remove Windows Messenger to your desktop.

• Double-click MessengerDisable.exe to run it.
• Place checkmarks in "Uninstall Windows Messenger" and "Hide Messenger from Outlook Express"
• Click Apply
• Click Exit

Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop -- but do not run it.
If it is not on your desktop, the below will not work.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]AWF::[/COLOR]
c:\program files\Hewlett-Packard\HP Boot Optimizer\bak\HPBootOp.csv
c:\program files\QuickTime\bak\qttask.exe
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]DirLook::[/COLOR]
c:\documents and settings\HP_Administrator\Local Settings\Application Data\Xara
[COLOR="DarkRed"]Folder::[/COLOR]
c:\windows\$NtUninstallKB62280$
C:\Documents and Settings\All Users\Application Data\PC Optimizer Pro
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}
C:\WINDOWS\Installer\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}
[COLOR="DarkRed"]RegLockDel::[/COLOR]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{399560AD-16A1-1C42-B8ABCDA82BB95BD1}\{612A140D-0F00-4178-3873E27B58551793}\{AE627BFA-B567-4F9A-57DD34442A0D5150}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{454884EE-A952-6288-D98E4C6628C57FD8}\{4E2828CC-5D4E-CAA4-0B0E2FF0C61DD876}\{D33FFB02-83E4-6D49-8432C9C83D6B1A26}*]
[COLOR="DarkRed"]RegNull::[/COLOR]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-165d-1b60-08eefd62c15f}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-3807-b174-d7acfd62c15f}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-4364-cb6d-110bfd62c15f}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-5319-2382-fbfffd62c15f}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-5840-09de-67c4fd62c15f}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-90bf-5240-1b7cfd62c15f}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-fbdc-c12b-e916fd62c15f}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{CD33F05B-57D8-EB8D-1C637C8E18479BDE}\{4B66B287-DF55-8BF6-0C7A245C073DF874}\{2B094E66-D192-13E4-CB3BD0799FCAC2FC}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FE8DBE89-D247-CDA0-331071706D351D5D}\{D7E03019-A44C-9829-6C33C3798CE56E87}\{A96D9761-82B1-07BB-8B5956B67D5931EC}*]
[COLOR="DarkRed"]Registry::[/COLOR]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"startup"=dword:00000000

Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.exe on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.

This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

Now run C:\MGtools\GetLogs.bat by double-clicking it.
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

Let me know what problems you still experience after running the above set of steps.

 

Well, thank you both for taking so much time trying to help me fix this thing.

I did as you suggested and had a few more issues.

While Combofix was initializing to scan, that box popped up again about an iexplorer.exe error. That was followed up by another pop up error message about a windows exception. Both boxes disappeared before I could write down what it said word for word or before I could snap a picture.

Combofix did detect rootkit activity again and rebooted my machine. After that, Combofix ran smoothly and created the report.

I started MGTools and towards the end another error popped up saying:

Application has generated an exception that could not be handled.
Process id=0x840 (2112), Thread id=0xdc8 (3528)
Click ok to terminate.
Click cancel to debug.

I hit cancel and another error popped up, but I didn't catch what it said before it went away.

Here are the reports.

 

Thanks for the descriptions.

Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop -- but do not run it.
If it is not on your desktop, the below will not work.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]AWF::[/COLOR]
c:\hp\drivers\hplsbwatcher\bak\lsburnwatcher.exe
[COLOR="DarkRed"]DDS::[/COLOR]
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
uInternet Settings,ProxyOverride = <local>;*.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
[COLOR="DarkRed"]Folder::[/COLOR]
c:\documents and settings\HP_Administrator\Local Settings\Application Data\Xara
C:\WINDOWS\E80F62FF5D3C4A1984099721F2928206.TMP
[COLOR="DarkRed"]RegNull::[/COLOR]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{399560AD-16A1-1C42-B8ABCDA82BB95BD1}\{612A140D-0F00-4178-3873E27B58551793}\{AE627BFA-B567-4F9A-57DD34442A0D5150}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{454884EE-A952-6288-D98E4C6628C57FD8}\{4E2828CC-5D4E-CAA4-0B0E2FF0C61DD876}\{D33FFB02-83E4-6D49-8432C9C83D6B1A26}*]
[COLOR="DarkRed"]Registry::[/COLOR]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{F32E003F-1F62-4BCC-B496-5725AF3B2124}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.exe on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.

This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

Download SystemLook from one of the links below and save it to your desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy and Paste the content of the following code box into the main text-field:

Code:

[COLOR="DarkRed"]:folderfind[/COLOR]
{ff24043d-55f8-5ce9-a20a-8337d9b4b888}
[COLOR="DarkRed"]:regfind[/COLOR]
ff24043d-55f8-5ce9-a20a-8337d9b4b888

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan and a file entitled SystemLook.txt will be created on your desktop.
• Attach that file to your next message. (How to attach)

 

Ok...

That iexplorer.exe error message popped up again, but I was prepared this time. Here's what it said...

iexplore.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
If you were in the middle of something... (and I'm sure you know the rest).

Combofix also still detected rootkit activity.

 

Other than ComboFix claiming a ZeroAccess infection is still present, what malware related problems are you experiencing?

 

That's part of my problem. I'm not sure what's Malware related and what's not.

My computer has just been running VERY slow lately. My main problems are when I try to flip from one program to another. I'm an amateur photographer who takes a LOT of pictures so I'll have my Jasc Paint Shop Pro program open along with Internet Explorer. When I try to go from JPSP to IE there's a huge lag to go back and forth. Even when I'm just using my JPSP program sometimes I get an error message about not having enough memory, but as far as I can tell I should have plenty. My Outlook Express Email is also very slow to load.

 

Hi Mandy,

I do not think the problem is malware related anymore as your latest logs are clean.

I suspect that the problem is related to the computer being an older model with lower end specifications, e.g. 1GB of memory, combined with the fact that you are using Norton Antivirus which with the amount of memory will just bog your system down even more.

We recommend at least 2GB of memory if running Windows XP.

__

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!

Be safe

 

Thank you both so much for helping to clean my computer up. I REALLY appreciate it!

I followed the last steps as you instructed so hopefully I'll be good to go now. It does seem to be going a little bit quicker now. I haven't tried to run my Jasc Program yet so we'll see what happens when I do.

 

You're welcome